Listen to this Post
How CVE-2026-54765 Works
Traefik is an open-source HTTP reverse proxy and load balancer that provides a Kubernetes Gateway API provider for routing external traffic to cluster services. This vulnerability arises from how Traefik constructs the dynamic HTTP backend service key for a Gateway HTTPRoute backendRef.
The core issue is that the service key is built using only the backend namespace, Service name, protocol, and port. It does not include any identifier from the HTTPRoute, listener, rule, or backendRef filter. When two accepted HTTPRoutes target the same backend `Service:port` but define different `backendRef` filters, Traefik can resolve both routes to the same child service.
The root cause lies in the `loadService()` function within pkg/provider/kubernetes/gateway/httproute.go. It starts the dynamic service name from the namespace and Service name only, loads backendRef filters using that same service name, and then appends the backend port. Both route-local WRR services end up referencing the same child service via the identical map key. When route configurations are merged using maps.Copy, the child service retains only one of the route/backendRef filter configurations, causing one route’s filter set to be applied to all requests reaching that backend.
This becomes a security issue when backendRef filters set, remove, or rewrite security-sensitive context such as tenant identity, authorization context, or headers trusted by the backend. An attacker who can create an accepted HTTPRoute sharing the same backend Service:port may cause their route’s filter context to be applied to another route’s requests. This can potentially cross namespace boundaries when a ReferenceGrant permits cross-namespace targeting. The vulnerability affects Traefik versions from v3.7.0 up to (but not including) v3.7.6 and is fixed in version v3.7.6.
DailyCVE Form:
Platform: Kubernetes Gateway API
Version: v3.7.0–v3.7.5
Vulnerability: Filter context collision
Severity: Medium (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N)
date: 2026-07-06
Prediction: 2026-07-06 (v3.7.6)
Analytics: What Undercode Say
The vulnerability stems from insufficient key composition in the dynamic service registry. The following code snippet from `pkg/provider/kubernetes/gateway/httproute.go` illustrates the problematic logic:
// pkg/provider/kubernetes/gateway/httproute.go:245
serviceName := provider.Normalize(namespace + "-" + string(backendRef.Name) + "-http")
// pkg/provider/kubernetes/gateway/httproute.go:258
middlewares, err := p.loadMiddlewares(conf, namespace, serviceName, backendRef.Filters, pathMatch)
// pkg/provider/kubernetes/gateway/httproute.go:304-317
portStr := strconv.FormatInt(int64(port), 10)
serviceName = provider.Normalize(serviceName + "-" + portStr)
...
conf.HTTP.Services[bash] = &dynamic.Service{LoadBalancer: lb, Middlewares: middlewares}
The test harness confirms the collision:
{
"name": "positive_cross_namespace_same_backend_filter_collision",
"pass": true,
"expected": {"route-a": "tenant-a", "route-b": "tenant-b"},
"observed": {"route-a": "tenant-a", "route-b": "tenant-a"},
"runtimeObserved": {"route-a": "tenant-a", "route-b": "tenant-a"},
"childServices": {"route-a": "default-whoami-http-80", "route-b": "default-whoami-http-80"}
}
Negative controls confirmed that separate backend `Service:port` keys produce correct per-route filter isolation.
Exploit
An attacker with the ability to create or modify an accepted HTTPRoute can exploit this vulnerability. The attack requires:
1. A Gateway listener with `allowedRoutes.namespaces.from: All`.
- A victim HTTPRoute (
route-ain namespacedefault) targeting `default/whoami:80` with a backendRef filter settingX-Tenant: tenant-a. - An attacker-controlled HTTPRoute (
route-bin namespaceattacker) targeting the same `default/whoami:80` via a ReferenceGrant, with a backendRef filter settingX-Tenant: tenant-b.
Both routes generate the same child service key (default-whoami-http-80). The second route’s filter configuration overwrites the first viamaps.Copy, causing the backend to receive all requests with the attacker’s tenant context.
Protection
- Upgrade Traefik to version v3.7.6 or later, which contains the fix.
- If upgrading is not immediately possible, avoid configurations where multiple HTTPRoutes with different backendRef filters target the same backend
Service:port. - Restrict `allowedRoutes.namespaces.from` to specific namespaces rather than `All` to limit cross-namespace attack vectors.
- Monitor for unexpected HTTPRoute creations or modifications that could indicate an attempt to exploit this vulnerability.
- Apply network policies to restrict which namespaces can communicate with the Gateway.
Impact
An attacker who can create or modify an accepted HTTPRoute can cause another accepted route that targets the same backend `Service:port` to use the wrong `backendRef` filter context. In cross-namespace Gateway deployments, this can cross namespace boundaries.
High-value impact: Gateway-injected tenant, identity, auth, role, header sanitization, Host rewrite, or path rewrite context that is trusted by the backend can be manipulated, leading to unauthorized access or data leakage.
Lower-value impact: If the overwritten header is only informational or used for observability, the security impact is reduced.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
